Session Gate Matrix

The machine gate index is skill-catalog/session-gates.json. This page maps each condition to its procedure owner. The architecture defines component responsibilities; the linked skills define agent actions.

Contents

• Required Entrypoints
• Turn Routing Contract
• Session Intent Ledger Contract
• Runtime Hook Graph Contract
• Dynamic Focus Contract
• Routing Surface Contract
• Work-Impact Projection Contract
• Runtime Checkpoints
• tool-checkpoint Visible Surface
• tool-checkpoint Batch / Continuation Compression
• Notes
• Managed Completion Recording Contract
• Current Selection and Bounded Recovery
• Repair and authority conditions

Required Entrypoints

Turn Routing Contract

Native prechecks remain observations. The assistant reuses them, selects the needed work, and applies merge-companion before affected skill changes or an explicitly requested backup review. Unrelated read-only lookup does not load that procedure or inspect the manifest again. A missing manual precheck precedes affected skill changes; an explicit defer leaves the entries undecided.

The current-session assistant routes every input, including a follow-up or status question, using current intent and continuing authority. A prior route is not the current input’s route. The current-session assistant may separately apply skill-evolution to the same exact session for a report; this procedure neither feeds task-router nor dispatches work.

The current-session assistant follows task-router to select work and construct the route candidate. It follows boundary-contract to declare allowed targets, exclusions and resources; neither procedure grants native permission.

Session Intent Ledger Contract

Core records canonical human input as a digest, character count and ordered event without persisting raw input. Codex intake commits directly. Claude UserPromptSubmit stages digest/count and native correlation; the trusted PreToolUse or Stop wrapper reconciles appended native actor rows. Human input advances canonical authority, task notifications retain the last human route, and unresolved observations remain pending. The current-session assistant records compressed semantic changes only when goals, constraints, decisions, questions or criteria materially change.

Runtime consumers use the public API with the exact session-receipt root/platform/session and the current input from the ledger. SQLite is authoritative; intent-state.json and intent-events.jsonl are import/export forms, and current-session.json is an advisory pointer. None supplies a substitute write identity. Missing recording leaves dependent operations unresolved. The assistant selects recovery only when needed for the objective or a required dependency and within existing authority; it never guesses identity or invents permission.

Session-intent-analyzer owns intake and correction provenance. Its ledger schema owns state fields, transaction rules, migration hashes and current response projection. Intake events and intent-state fields do not store raw prompts, full conversations or tool outputs, system/developer instructions or secrets. Separate Core review records retain authorized answer and original-source snapshots and the model’s review judgments; those review records are not session-intent summaries. Hookless work follows the same identity contract; a direct answer uses no tools.

Runtime Hook Graph Contract

1. The session-intent-analyzer SessionStart hook supplies the session receipt. The UserPromptSubmit hook records each input and adds model context only when that receipt was not delivered or intake failed. Core intake establishes exact canonical human input through direct Codex observation or trusted Claude reconciliation. Read-state remains a pure read. The current-session assistant applies task-router to select work; it separately applies skill-evolution when report-only analysis is required.
2. The current-session assistant submits the normal route candidate to Core. Core Python code validates current input, ownership, admission and selected criteria before storing the ready projection.
3. The current-session assistant follows any required boundary and owning workflow. The host enforces tool permission and executes permitted calls. The applicable Ghost-ALICE Autopilot pretool records provenance; PostToolUse retains strict audit.
4. At completion, the guard and Ghost-ALICE Autopilot call the same input/body-bound Core assessment. Their independently registered hooks do not require a policy ordering between them.

Tool-checkpoint runs at the before-tool stage (host PreToolUse/BeforeTool) and is not user-input intake. Tool payloads and audit metadata do not grant native permission. Installed configuration proves neither hook firing nor host execution; live-smoke-regression owns required runtime observations.

Dynamic Focus Contract

The current-session assistant selects the subject of judgment: micro for an individual result or field; meso for a subtask or source-target mapping; macro for integrated output and cross-document consistency; meta for necessity, task definition or premise. A mismatch’s observed location is not necessarily its cause. When investigation is needed, evidence may move focus wider, narrower or to another target at the same scope. Focus is independent of verification burden; these layers are neither an ascending sequence nor an expansion of authority. Meta review does not itself require a user question.

When work selection must change, the current-session assistant applies task-router again using the affected result and contrary evidence. It compares the result with its relevant reference and investigates the cause far enough to select any needed authorized correction. It can retain an unresolved detail or omit nonessential work when the objective and required dependencies are unaffected; it does not create a recovery task merely because a mismatch exists. Required criteria still need positive support, including for the combined result. Mandatory checks remain required. A discretionary check runs only when its attainable outcomes can change the next decision; the evidence-selection owner below defines the stopping rule. The static calls graph does not prescribe repeated runtime checks.

Routing Surface Contract

The current-session assistant applies session-intent-analyzer to express semantic facts and decisions and submits them to the Python ledger writer. It applies task-router to make the reusable work judgment. Display code and the assistant use the resulting routing-surface values for change-depth, focus-layer and verification-complexity instead of inventing another scale. Unknown or conflicting values require fuller visibility and reconsideration of the affected selection.

The current-session assistant applying task-router preserves the primary request and terminal objective. Investigation and worktree inspection remain means unless requested as deliverables. Accepted-continuation requires recorded acceptance and does not lower proof requirements.

Routing details separate a direct answer (direct-response) and a confirmation question (clarification-only) from work. A general why/how premise and ambient workspace do not authorize local diagnosis. A status question or correction normally steers unfinished authorized work; an explicit stop/pause governs continuation. A direct answer uses supplied conversation, performs no agent-side tools or metadata repair and emits only resolved content; a confirmation question takes the form the common contract’s Session Intent section sets. That condition does not prohibit authorized route registration on a work completion path.

Work-Impact Projection Contract

Hooks classify values by whether they change the work boundary, focus layer, verification burden, or recovery.

• agent_visibility.profile controls display, not hook execution or strict audit.
• Forced/risk/gate values and failed verification retain full model hints and forced visibility.
• Routine/debug values remain in the strict log and enter model guidance only when they affect a work decision.
• Unknown, ambiguous or failed values expose fuller context and reopen the affected judgment.

Duplicate clean reminders, no-op audit entries and correlation metadata do not independently justify new work. Token reduction is a consequence, not a success metric.

Runtime Checkpoints

Decision-relevant routing guidance is owned by task-router. The current-session assistant records a skill call only after using a fresh or valid retained instruction body and following that workflow; metadata matching is not execution.

Verification-before-completion owns the shared completion-check and partial-check formats and their criterion/claim/evidence mapping. Core completion acceptance requires authenticated review of the claims, original sources and complete response under the current owned route. Skill loading remains workflow guidance and audit activity, not a separate acceptance prerequisite. Finalized completion requires supported verdicts with no unverified criteria. A partial-success report retains the full contract and identifies unresolved criteria; it cannot present the successful subset as whole-task completion.

The current-session assistant uses valid unchanged proof at its original source/time. A formatting or route error does not create a new business-verification requirement. A displayed trace does not establish proof; strict internal audit and actual workflow evidence remain required. Control names and enum values stay English in both language editions.

tool-checkpoint Visible Surface

The common contract’s io-trace Transparency Rule owns checkpoint visibility. The current-session assistant surfaces a checkpoint when its result changes authority, the next decision or required verification. It reuses unchanged evidence and reads only material that can affect the decision. A receipt or a healthy tool call alone does not require another message.

tool-checkpoint Batch / Continuation Compression

Hooks check every call and preserve strict audit while suppressing unchanged repeated user-facing blocks in the same input lineage. Batch and continuation forms do not grant permission.

Continuation refers only to polling the same process/session/tool-call ID. A denial, mismatch or relevant state change can require a new checkpoint. Polling and a new input alone do not require repeating guidance.

Notes

Procedure ownership prevents duplicated rules from drifting. The current-session assistant follows instruction-body reuse and records actual reads or valid reuse internally. Routine clean states need no repeated prose; pending, changed and failed states retain their decision-relevant notice.

Source edit, named test pass, installed bytes, native execution, accepted publication, applied criterion and visible answer are separate claims. Evidence for one stage cannot establish another.

Managed Completion Recording Contract

For a new completion or partial submission, Core Python code checks the current owned route before proof formatting and authenticated semantic review. A missing route therefore returns the route defect before requesting corrected proof fields.

For this condition, the responding model records both judgments using the owning review procedure. The Core response flow explains authentication and native answer delivery; output semantics distinguishes supported and unsupported results.

The managed registered hook chain uses v2 unit-qualified admitted criteria; direct public APIs retain the v1 default. Source APIs, runtime modules, ledger, project, installed skills and platform state retain separate location bindings. An ordinary upgrade preserves ledger authority; transport does not grant origin, session, admission or approval.

On the managed native Stop path, the Ghost-ALICE Autopilot adapter uses its prepared provenance receipt and Core-authenticated review to record applicable proof. The model does not issue a second publication command for that native path. Accepted publication and applied completion remain distinct: the adapter authenticates the records before requesting Core’s guarded criterion update. Unsupported or unresolved criteria remain unmet. A supported report may fulfill no work criterion and require no publication.

Current Selection and Bounded Recovery

Core validates the current response route supplied by the model following task-router. A direct-answer or confirmation projection selects no execution units; a requested lookup is work. New input changes the route binding while preserving stable work units and unchanged original evidence.

A named route, proof or recording defect returns to its procedure owner below. The model chooses correction only when needed for the objective or a required dependency and within authority. Unsupported claims are revised or withdrawn; required unresolved criteria stay unmet. Identical unchanged recording failure parks dependent application without replaying business work or blocking independent authorized work.

Review and delivery owns the calling sequence and correction shape. Tool output semantics names the returned selectors. Core’s retained-report path applies only when original applied proof supports the exact entire statement; added prose or a broader claim needs its own review.

Repair and authority conditions

• Boundary-contract: Authority and renewal owns human authority, allowed targets and resource limits.
• Systematic-debugging: Incident accounting and continuation owns failed repair rounds, reassessment and bounded continuation.
• Verification-before-completion: Evidence Selection And Stop Gate owns useful checks and proof reuse.
• Ghost-ALICE Autopilot publication contract owns capture, publication, application and recording recovery.

These owners preserve cumulative attempts, original source/time and unaffected criteria. A branch-local failure blocks its dependencies, not unrelated authorized work.